IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

How to handle Private IPs coming as artifacts in the SOAR from Qradar

  • 1.  How to handle Private IPs coming as artifacts in the SOAR from Qradar

    Posted 11/21/24 07:39 AM

    Hi community , 

    As you know , the QRadar plugin APP will populate IPs and other artifacts in the artifacts tab of an incident in the SOAR , one issue I'm facing is that some of the IPs are Private IPs (which imo should not populate there) , how do you handle excluding these IPs.

    I can see in the plugin page that we can exclude a reference set created in QRadar , but from my understanding you cant add IP ranges in references lists.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------


Related Content